Alertas de Seguridad de la Información

M Alto vulnerabilidad

28/07/2026

[CVE-2026-45293] WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding …

WordPress Coding Standards is a set of PHP_CodeSniffer rules (sniffs) that enforce WordPress coding conventions. From 0.14.1 until 3.4.1, the WordPress.WP.EnqueuedResourceParameters sniff (active in the WordPress and WordPress-Extra rulesets) reconstructed the $ver argument passed to functions such as wp_enqueue_script() and ran it through eval() inside its is_falsy() method, so a maliciously craf…

nvdaltovulnerabilidad CVSS 8.6 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-43910] Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C Web…

Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost, directConnectPort, and directConnectPath fields from the server's NEW_SESSION response and rebuilds the client's server URL from them, validating only …

nvdaltovulnerabilidad CVSS 8.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-66299] Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This iss…

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. Users are recommended to remove the examples web application or …

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-59878] Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ Al…

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-of-service behavior by sending a frame size value. This cause the NIO threads to die and if done rapidly enough can lead to exhaustion of the NIO thread pool denying service to other connections. This i…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-65881] Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account acces…

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62432] The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without …

The EVTCHNOP_expand_array hypercall checks for whether FIFO event channels are enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

nvdaltovulnerabilidad CVSS 7.3 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62426] [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62427] [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabiliti…

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the system, sysctl and platform operations are used by the control domain or a possible Xenstore domain. Some of these operations may not be executed in parallel, so a system-wide lock each is used. The way those locks are acquired is, however, not providing …

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-62430] Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs t…

Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-49332] A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only …

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity that may override the legitimate …

nvdaltovulnerabilidad CVSS 8.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-42492] Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and…

Xenstore, to have an up-to-date picture of the entire system, wants to know of domains appearing and disappearing. To make this more robust, a new XEN_DOMCTL_get_domain_state was introduced. The management of the bitmap underlying that operation is tied into the binding of the VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear down the bitmap even in cases when it wasn't set…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-42493] Addressing certain issues, in particular related to operations which may take excessively long and t…

Addressing certain issues, in particular related to operations which may take excessively long and therefore would need preemption, has turned out overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for people to use at their own (security) risk. Memory-wise small enough guests may still be o…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-15025] The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPre…

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator_mautic_segment_fetch, automator_mautic_tags_fetch, and automator_mautic_render_contact_fields AJAX actions due to a missing capability check and missing nonce v…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14328] The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is …

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the `wp_ajax_pos_get_option` AJAX handler, which verifies only a nonce that is localized to every logged-in admin-area user via `admin_enqueue_scripts` — without any capabilit…

nvdaltovulnerabilidad CVSS 8.8 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14785] The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' …

The Web Directory Free plugin for WordPress is vulnerable to generic SQL Injection via the 'levels' parameter in all versions up to, and including, 1.7.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that ca…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-59764] ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability …

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-61376] ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability …

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in Restore Settings. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

nvdaltovulnerabilidad CVSS 7.2 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-13161] The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to gene…

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all versions up to, and including, 1.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addition…

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14169] Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent …

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.

nvdaltovulnerabilidad CVSS 8.1 NVD

M Alto vulnerabilidad

28/07/2026

[CVE-2026-14516] The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to …

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL qu…

nvdaltovulnerabilidad CVSS 7.5 NVD